Privacy notice
Last updated July 2026.
CleanDone is software that helps you run your cleaning business. It's operated by Makappen Ltd ("we", "us"). This notice explains what personal data we handle and how we look after it.
Who controls your data?
When you sign up as a cleaner, youare the controller of your customers' personal data - you decide what to collect and why. We're your processorfor that data: we hold and process it on your behalf, on your instructions, to run the service. For your own account details, we're the controller. As a controller of your customers' data you may need your own ICO registration and your own privacy notice for them, so it's worth taking advice on that.
What data do we handle?
- Your account: your name, email, mobile, password (stored only as a secure hash), and any bank details you choose to share with clients (encrypted).
- Your customers: the details you add or that a customer submits through your booking page - name, contact details, home address, and any access notes (for example where a key is kept) - plus the cleans, quotes and payment status you track.
- Team members: if you invite someone, their name, and (if you give them a login) their email and phone, plus a secure hash of their password.
- Job photos: before and after photos you or your team take, stored against that visit.
- Customer portal: a customer can sign in with their email (we send a one-time link and keep a sign-in session) to flag holidays and message you.
- Payments: if you turn on in-app payments, we store invoices and expenses and a secure reference to a customer's saved card or Direct Debit - never the card number or bank account details, which the payment provider holds, not us.
Why do we use it, and what's our legal basis?
We use it to provide the service to you (that's our contract with you), and to send booking-related messages to your customers on your behalf (your legitimate interest in running your business, and the contract between you and your customer). We don't sell your data or use it for advertising.
How do we keep it safe?
Everything travels over an encrypted connection (HTTPS). The most sensitive details - home addresses, key locations and alarm notes - are also encrypted at rest with AES-256-GCM, so they can't be read in the database without the key. Passwords are never stored in plain text, and access to your data is scoped to your account only. To protect sign-in and the booking page from abuse, we briefly process a visitor's IP address to rate-limit it; it's stored only as a hash and ages out quickly.
What about activity logs and analytics?
For security and accountability, we keep an activity log of significant actions on your account - sign-ins, team changes, settings changes and data exports - showing who did what and when. It holds no passwords or secrets, and the owner and admins can see it under More → Activity log. We also collect privacy-first, aggregate usage stats (like which pages get visited) to improve the app. These are cookieless: they set nothing on your device, don't follow you across other sites, and don't build advertising profiles - so they need no consent banner.
Who else is involved?
We use a small set of trusted providers to run the service. Each only handles what it needs to do its job:
- Vercel - hosting and cookieless usage analytics
- Supabase - the database and photo storage
- Sentry - error monitoring, so we're alerted when something breaks and can fix it. It's a US company; we use its EU (Frankfurt) data region and have set it up to keep personal data out of those reports - no tracking, no session recording, and no form contents or IP addresses.
- Resend - email
- Twilio - text messages, when you enable them
- postcodes.io - turns a postcode into a map location (postcode only)
- Stripe and GoCardless - payments, both for any subscription you take and, if you turn it on, for collecting from your own customers
- Google - only if you choose "Continue with Google" to sign in (we receive your name and email)
When you collect a payment in-app, your customer's name and email are shared with Stripe or GoCardless so they can set up or take the payment.
Where is your data stored?
Your data is stored in the UK - our database and your job photos are held in London (with Supabase). The app itself runs in the EU/EEA (Dublin, on Vercel), which UK rules treat as an equivalent level of protection. A few providers that handle email, texts or payments (Resend, Twilio, Stripe, Google) may process some data in the US, under approved safeguards.
What if I turn on calendar sync?
If you turn on calendar sync, we create a private link that your calendar app (Google, Outlook or Apple) reads on a schedule. Because your calendar app keeps a copy, this shares your clients' names and addresses with that provider. The link is a long, unguessable secret; you can reset it (which revokes the old one) or turn sync off any time from Settings, and it's off until you switch it on.
How long do we keep it?
We keep your account and your customers' data for as long as your account is active - you control it, and can delete a client (and all their data) or your whole account any time from the app. Deletion is permanent, and closing your account erases everything.
- Financial records (such as invoices) - kept for 6 years to meet UK tax law.
- Job photos - kept until you delete the client or your account.
- Short-lived items we control (one-time sign-in links, the hashed data used to rate-limit abuse) - purged automatically.
- The security activity log - kept for up to 24 months.
What are your rights?
You can access, correct, export or delete your data. In the app:
- Download my data (Settings) gives you a full export.
- Delete my account erases everything.
- Delete permanently on a client's page acts on that customer's data.
For anything else, email support@cleandone.co.uk. You can also complain to the Information Commissioner's Office (ico.org.uk).
Do we use cookies?
Only essential ones, to keep you signed in - one for the cleaner app and one for the customer portal. Our analytics are cookieless, and there are no advertising or tracking cookies. There's more in our cookie policy.
How to reach us
Questions about this notice or your data? Email support@cleandone.co.uk.